When a tenant HTTPRoute targets a shared Gateway, its backendRefs still resolve to tenant Services. We wrote up the policy in our generic sync plugin: which fields cross that boundary, which references are translated, and the Argo CD failure that changed it.